krb5 commit: Fix krb5_cccol_have_content() bad pointer free

ghudson at mit.edu ghudson at mit.edu
Sat Sep 2 22:36:56 EDT 2023


https://github.com/krb5/krb5/commit/635c8cca65b745476d07c1f5ff701445db25c10d
commit 635c8cca65b745476d07c1f5ff701445db25c10d
Author: Ilya Gladyshev <ilya.v.gladyshev at gmail.com>
Date:   Wed Aug 30 21:19:59 2023 +0100

    Fix krb5_cccol_have_content() bad pointer free
    
    krb5_cccol_have_content() calls krb5_cc_get_principal() within a loop,
    and frees the resulting principal on success or failure.  Set princ to
    null before each call to ensure we don't free a dangling pointer.
    
    [ghudson at mit.edu: rewrote commit message; moved assignment for greater
    clarity]
    
    ticket: 9103
    tags: pullup
    target_version: 1.21-next
    target_version: 1.20-next

 src/lib/krb5/ccache/cccursor.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/lib/krb5/ccache/cccursor.c b/src/lib/krb5/ccache/cccursor.c
index 4bcb66b71..926873f2a 100644
--- a/src/lib/krb5/ccache/cccursor.c
+++ b/src/lib/krb5/ccache/cccursor.c
@@ -249,6 +249,7 @@ krb5_cccol_have_content(krb5_context context)
         save_first_error(context, ret, &errsave);
         if (ret || cache == NULL)
             break;
+        princ = NULL;
         ret = krb5_cc_get_principal(context, cache, &princ);
         save_first_error(context, ret, &errsave);
         if (!ret)


More information about the cvs-krb5 mailing list